Re: [PATCH bpf-next v2 5/6] selftests/bpf: Add tests for pointer type merge at a shared load

On 8/15/26 12:56 AM, [email protected] wrote:
[...]
> However, the other two commits appear untested:
> 
> bcfd0d6a160f changed check_ptr_to_btf_access() from checking
> type_flag(reg->type) & PTR_UNTRUSTED to calling
> bpf_may_fault_on_deref(), so a BPF_STX through a bare PTR_TO_BTF_ID is
> now rejected with "only read is supported". The changelog documents a
> reachable bpf_qdisc panic (next = sch->next_sched; next->limit = 1000;),
> but no __failure / __msg("only read is supported") case is added here or
> in progs/bpf_qdisc_*.c. Only verifier_global_ptr_args.c and
> verifier_netfilter_ctx.c assert that message, and both do so for
> PTR_UNTRUSTED pointers that the old check already caught, so the
> newly-closed hole is untested.

I can either follow-up together with the hid-bpf one or do a v3 and then add
also a qdisc write test if desired.

> bef47cf76444 states that PTR_TO_BTF_ID|PTR_UNTRUSTED|MEM_ALLOC|NON_OWN_REF
> and PTR_TO_BTF_ID|PTR_UNTRUSTED|MEM_RCU were reachable and left as plain
> loads (two Fixes: tags). The added tests only produce
> ringbuf/rdonly/bare-BTF-ID types, all of which the old exact-match list
> in bpf_convert_ctx_accesses() already handled or which the merge path
> covers.

Covered by the selftest in patch 6/6 (PTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED |
NON_OWN_REF and PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_RCU).

> Would it make sense to add tests for the bcfd0d6a160f store-rejection path
> and the bef47cf76444 MEM_ALLOC|NON_OWN_REF and MEM_RCU cases here?